Windows PE Powershell WMI functionality with unattended file

309 Views Asked by At

I have a Windows PE image that runs a few WMI queries and a .Net app based on the results.

It has the following packages in it:

  • Microsoft-Windows-WinPE-LanguagePack-Package~31bf3856ad364e35~amd64~en-
  • Microsoft-Windows-WinPE-Package~31bf3856ad364e35~amd64~~10.0.20348.1
  • WinPE-NetFx-Package~31bf3856ad364e35~amd64~en-US~10.0.20348.1
  • WinPE-NetFx-Package~31bf3856ad364e35~amd64~~10.0.20348.1
  • WinPE-PowerShell-Package~31bf3856ad364e35~amd64~en-US~10.0.20348.1
  • WinPE-PowerShell-Package~31bf3856ad364e35~amd64~~10.0.20348.1
  • WinPE-Scripting-Package~31bf3856ad364e35~amd64~en-US~10.0.20348.1
  • WinPE-Scripting-Package~31bf3856ad364e35~amd64~~10.0.20348.1
  • WinPE-WMI-Package~31bf3856ad364e35~amd64~en-US~10.0.20348.1
  • WinPE-WMI-Package~31bf3856ad364e35~amd64~~10.0.20348.1

The I need to disable networking in the image so I use the following unattend file:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    </servicing>
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="AMD64">
            <EnableNetwork>false</EnableNetwork>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

When I run the unattend via wpeinit -unattend I am not able to WMI queries in powershell and get the error: "Invalid access to memory location" When I run without the unattend file, I can run WMI queries in powershell just fine

My first assumption was that I needed to add the packages into unattend file, but I got the same behavior:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <servicing>
        <package action="install">
            <assemblyIdentity name="WinPE-WMI-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-WMI.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-Scripting-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-PowerShell-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-PowerShell.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-NetFx-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-NetFx.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-NetFx-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="en-US" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-NetFx_en-us.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-PowerShell-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="en-US" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-PowerShell_en-us.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-Scripting-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="en-US" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab" />
        </package>
        <package action="install">
            <assemblyIdentity name="WinPE-WMI-Package" version="10.0.20348.1" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="en-US" versionScope="nonSxS" />
            <source location="C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-WMI_en-us.cab" />
        </package>
    </servicing>
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="AMD64">
            <EnableNetwork>false</EnableNetwork>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

I can replicate this issue in multiple versions of windows PE. Am I missing something in my unattend file?

0

There are 0 best solutions below